From eb1b70daa801c34e07c64c8b143cd899eb5ecbae Mon Sep 17 00:00:00 2001 From: Brendan Gregg Date: Mon, 25 Jul 2016 16:13:35 -0700 Subject: [PATCH] fix uprobe examples to read correct argument --- examples/tracing/strlen_count.py | 4 ++-- examples/tracing/strlen_snoop.py | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/examples/tracing/strlen_count.py b/examples/tracing/strlen_count.py index dfc98d3..7d2db89 100755 --- a/examples/tracing/strlen_count.py +++ b/examples/tracing/strlen_count.py @@ -24,13 +24,13 @@ struct key_t { BPF_HASH(counts, struct key_t); int count(struct pt_regs *ctx) { - if (!PT_REGS_PARM2(ctx)) + if (!PT_REGS_PARM1(ctx)) return 0; struct key_t key = {}; u64 zero = 0, *val; - bpf_probe_read(&key.c, sizeof(key.c), (void *)PT_REGS_PARM2(ctx)); + bpf_probe_read(&key.c, sizeof(key.c), (void *)PT_REGS_PARM1(ctx)); val = counts.lookup_or_init(&key, &zero); (*val)++; return 0; diff --git a/examples/tracing/strlen_snoop.py b/examples/tracing/strlen_snoop.py index 9ee058a..c3c7199 100755 --- a/examples/tracing/strlen_snoop.py +++ b/examples/tracing/strlen_snoop.py @@ -26,7 +26,7 @@ pid = sys.argv[1] bpf_text = """ #include int printarg(struct pt_regs *ctx) { - if (!PT_REGS_PARM2(ctx)) + if (!PT_REGS_PARM1(ctx)) return 0; u32 pid = bpf_get_current_pid_tgid(); @@ -34,7 +34,7 @@ int printarg(struct pt_regs *ctx) { return 0; char str[80] = {}; - bpf_probe_read(&str, sizeof(str), (void *)PT_REGS_PARM2(ctx)); + bpf_probe_read(&str, sizeof(str), (void *)PT_REGS_PARM1(ctx)); bpf_trace_printk("%s\\n", &str); return 0; -- 2.7.4